package utils

import (
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/awserr"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/secretsmanager"
	"go.uber.org/zap"
)

func GetAwsSecret(logger *zap.Logger, secretName, region string) (sk string, err error) {
	logger.Info("GetAwsSecret start...")
	defer logger.Info("GetAwsSecret end...", zap.Error(err))

	sess, err := session.NewSession()
	if err != nil {
		// Handle session creation error
		logger.Error("%v", zap.Error(err))
		return "", err
	}
	svc := secretsmanager.New(sess,
		aws.NewConfig().WithRegion(region))
	input := &secretsmanager.GetSecretValueInput{
		SecretId:     aws.String(secretName),
		VersionStage: aws.String("AWSCURRENT"), // VersionStage defaults to AWSCURRENT if unspecified
	}

	// In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
	// See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

	result, err := svc.GetSecretValue(input)
	if err != nil {
		if aerr, ok := err.(awserr.Error); ok {
			switch aerr.Code() {
			case secretsmanager.ErrCodeDecryptionFailure:
				// Secrets Manager can't decrypt the protected secret text using the provided KMS key.
				logger.Error("failure and error", zap.Any("failure", secretsmanager.ErrCodeDecryptionFailure), zap.Error(aerr))

			case secretsmanager.ErrCodeInternalServiceError:
				// An error occurred on the server side.
				logger.Error("failure and error", zap.Any("failure", secretsmanager.ErrCodeInternalServiceError), zap.Error(aerr))

			case secretsmanager.ErrCodeInvalidParameterException:
				// You provided an invalid value for a parameter.
				logger.Error("failure and error", zap.Any("failure", secretsmanager.ErrCodeInvalidParameterException), zap.Error(aerr))

			case secretsmanager.ErrCodeInvalidRequestException:
				// You provided a parameter value that is not valid for the current state of the resource.
				logger.Error("failure and error", zap.Any("failure", secretsmanager.ErrCodeInvalidRequestException), zap.Error(aerr))

			case secretsmanager.ErrCodeResourceNotFoundException:
				// We can't find the resource that you asked for.
				logger.Error("failure and error", zap.Any("failure", secretsmanager.ErrCodeResourceNotFoundException), zap.Error(aerr))
			}
		} else {
			// Print the error, cast err to awserr.Error to get the Code and
			// Message from an error.
			logger.Error("aws get secret failed.", zap.Error(err))
		}
		return "", err
	}
	return *result.SecretString, nil
}